Privacy Policy.

This Privacy Policy describes how Axon AI Labs, Inc. ("Axon AI", "we", "us", or "our"), a Delaware C-Corporation, collects, uses, stores, and discloses personal data in connection with our AI-powered voice, SMS, and email agent services (the "Services"). We operate across multiple jurisdictions including the United States, Poland, and the Netherlands, and are committed to compliance with applicable privacy regulations including the General Data Protection Regulation ("GDPR") and other applicable laws.

By using our Services, you acknowledge that you have read and understood this Privacy Policy.

1. Data Controller

The data controller responsible for personal data processed under this Policy is:

Axon AI Labs, Inc.
838 Walker Rd., Suite 21-2, Dover, Delaware 19904, County of Kent, United States
Email: privacy@axonlive.ai

For EU/EEA data subjects, our operational subsidiary in Poland acts as the local point of contact for GDPR-related matters.

2. Scope of this Policy

This Policy applies to:

• Operators and property management companies that use our Services ("Clients");
• End users and tenants who interact with our AI agents via voice calls, SMS, or email;
• Visitors to our websites and web-based interfaces;
• Prospective clients, investors, and business contacts.

Our AI agents — including agents deployed under names such as "Sophie", "Emilia", "Lisa", or "Olivia" — may interact directly with tenants and prospects on behalf of our Clients. In such cases, Axon AI acts as a data processor on behalf of the Client (the data controller), unless otherwise agreed. Processing of personal data in the context of Client relationships is governed by a separate Data Processing Agreement ("DPA") concluded with each Client.

3. Data We Collect

3.1 Data Provided Directly

• Name, email address, phone number, and other contact details;
• Communication content: voice call recordings and transcripts, SMS messages, email correspondence;
• Tenancy-related information provided during agent interactions (e.g., unit inquiries, lease preferences, outstanding balances);
• Payment-related identifiers (processed via third-party processors; we do not store full payment card data).

3.2 Data Collected Automatically

• Call metadata: timestamps, call duration, caller ID, call outcome;
• System logs, IP addresses, browser type, and device information;
• Usage analytics related to our platform and agent performance.

3.3 Data Received from Third Parties

• Lead data from property listing platforms (e.g., OtoDom, OLX, Pararius);
• CRM or property management system data provided by our Clients;
• Identity verification data where required.

4. Legal Basis for Processing (GDPR)

For data subjects in the EU/EEA, we rely on the following legal bases:

• Contract performance: to provide the Services under agreements with our Clients;
• Legitimate interests: to improve our AI models, ensure platform security, and conduct business development — where such interests are not overridden by individual rights;
• Legal obligation: to comply with applicable laws (e.g., GDPR, Polish UODO, Dutch AVG);
• Consent: where we explicitly request it, e.g., for call recording disclosures. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

5. How We Use Personal Data

• To operate and deliver our AI agent Services on behalf of Clients;
• To respond to inquiries, manage leasing workflows, and process debt collection communications where engaged;
• To improve and train our AI models and conversational systems (using anonymized or aggregated data where possible);
• To fulfill legal and contractual obligations;
• To communicate with Clients, investors, and business contacts;
• To detect fraud, abuse, and ensure platform security.

6. Call Recording and Voice Data

Our Services may involve the recording and transcription of telephone calls. Where required by applicable law:

• Callers are informed at the beginning of each interaction that the call may be recorded;
• Recordings are retained for the period specified in the applicable Client agreement or as required by law;
• Voice data may be processed by third-party AI inference providers subject to data processing agreements.

In the Netherlands, call recordings comply with Article 13 of the Dutch Telecommunications Act and GDPR requirements. In Poland, call recordings comply with the Polish Telecommunications Law (Prawo Telekomunikacyjne) and UODO regulations.

7. Data Sharing and Third Parties

We do not sell personal data. We may share data with:

• Clients (property operators) as data controllers for their tenant and prospect data;
• Sub-processors listed below, acting under appropriate data processing agreements (DPAs);
• Payment processors (e.g., Stripe) for billing purposes;
• Legal, regulatory, or government authorities where required by law;
• Professional advisers (legal counsel, accountants) under confidentiality obligations.

A Data Processing Agreement ("DPA") is available and required for all Client relationships involving EU/EEA personal data. The DPA governs the rights and obligations of Axon AI as a data processor acting on behalf of the Client as data controller, in accordance with Article 28 GDPR. Clients may request the DPA by contacting privacy@axonlive.ai.

8. Data Retention

We retain personal data for as long as necessary to provide the Services and fulfill the purposes set out in this Policy, including:

• Client and operator data: for the duration of the contractual relationship and up to 5 years thereafter for legal and compliance purposes;
• Call recordings and transcripts: as agreed with the Client, typically 12 months unless otherwise required;
• Marketing and contact data: until consent is withdrawn or an objection is lodged;
• Financial records: as required under applicable tax and accounting law (typically 5–7 years).

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right of access: to receive a copy of the personal data we hold about you;
• Right to rectification: to have inaccurate data corrected;
• Right to erasure ("right to be forgotten"): to request deletion of your data under certain circumstances;
• Right to restriction: to limit how we process your data;
• Right to data portability: to receive your data in a structured, machine-readable format;
• Right to object: to processing based on legitimate interests or for direct marketing purposes;
• Right to withdraw consent: at any time, without affecting prior processing;
• Right to lodge a complaint: with the relevant supervisory authority (in Poland: UODO; in the Netherlands: Autoriteit Persoonsgegevens; in the US: applicable state regulators).

To exercise any of these rights, please contact us at: privacy@axonlive.ai. We will respond within 30 days (or as required by applicable law).

10. Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or destruction. These include encrypted data transmission, access controls, and regular security assessments. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

11. Cookies and Tracking Technologies

Our websites and interfaces may use cookies and similar tracking technologies for analytics and functionality purposes. You may control cookie settings through your browser. A more detailed Cookie Policy is available upon request.

12. Children's Privacy

Our Services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us immediately.

13. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to Clients and, where feasible, to affected data subjects. The current version will always be available upon request or on our website.

14. EU-U.S. Data Privacy Framework (DPF)

Axon AI Labs, Inc. complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) as set forth by the U.S. Department of Commerce. Axon AI Labs has self-certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF. If there is any conflict between the terms in this Privacy Policy and the EU-U.S. DPF Principles, the Principles shall govern.

To learn more about the Data Privacy Framework program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

14.1 Types of Personal Data Covered

Our DPF self-certification covers personal data other than Human Resources data received from the European Union, including personal data of tenants, prospects, and end users processed through our AI agent Services on behalf of our Clients.

14.2 Purposes of Processing

Personal data received under the EU-U.S. DPF is processed solely for the purposes described in this Privacy Policy, including the operation of AI voice, SMS, and email agent services, communication with tenants and property management clients, and related business activities.

14.3 Accountability for Onward Transfers

Axon AI Labs remains responsible and liable under the EU-U.S. DPF Principles if third-party agents it engages process personal data in a manner inconsistent with the Principles, unless Axon AI Labs demonstrates that it is not responsible for the event giving rise to the damage.

14.4 Independent Recourse Mechanism

In compliance with the EU-U.S. DPF Principles, Axon AI Labs commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF to the EU Data Protection Authorities (DPA Panel). If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your complaint to your satisfaction, please contact the relevant EU Data Protection Authority in your country of residence for more information or to file a complaint.

EU data subjects with inquiries or complaints regarding our DPF compliance should first contact Axon AI Labs at: privacy@axonlive.ai.

14.5 Binding Arbitration

EU data subjects may invoke binding arbitration under the DPF Annex I (Arbitral Model) for residual claims not resolved by other DPF mechanisms, subject to the conditions set forth in the EU-U.S. DPF Principles.

14.6 FTC Jurisdiction

Axon AI Labs is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC) with respect to its compliance with the EU-U.S. DPF Principles.

15. Contact

For any questions, requests, or complaints regarding this Privacy Policy or the processing of your personal data, please contact:

Axon AI Labs, Inc.
838 Walker Rd., Suite 21-2, Dover, Delaware 19904, County of Kent, United States
Email: privacy@axonlive.ai
Operational contact (EU/Poland): as indicated in the applicable Client agreement